Introduction
CVE-2025-59147 is a vulnerability in Suricata's TCP session handling. It lets attackers slip malicious traffic past network monitoring, or trigger unnecessary flow blocks, simply by manipulating TCP handshake packets. It affects a wide range of deployments in both detection and prevention modes.
Suricata is an open-source network intrusion detection and prevention engine developed by the Open Information Security Foundation (OISF). Enterprise, service provider, and research networks widely use it for deep packet inspection, threat detection, and network security monitoring. Its multi-threaded architecture and protocol parsing make it a popular choice for high-performance environments.
Technical Information
CVE-2025-59147 sits in Suricata's TCP stream tracking and session management subsystem. An attacker triggers it by sending multiple TCP SYN packets with different sequence numbers within the same flow tuple. Suricata's logic for establishing and maintaining session state mishandles this case, and the outcome depends on the system's operational mode:
- IDS mode: Suricata may fail to pick up the TCP session, which bypasses detection and logging. Malicious traffic can cross the network without Suricata inspecting or recording it.
- IPS mode: The same flaw makes Suricata block the entire flow, which can deny service to legitimate connections.
The vulnerability is classified as CWE-358: Improperly Implemented Security Check for Standard. Suricata's implementation does not fully conform to the expected TCP session validation and tracking standards, particularly for edge cases with multiple SYN packets carrying different sequence numbers.
The root cause is a logic flaw in how Suricata correlates SYN packets and establishes session state. If the sequence numbers differ, Suricata may not recognize later packets as part of the same session, and it can then lose visibility of the flow or take the wrong action on it. Attackers can exploit this with packet-crafting tools that generate the required traffic patterns.
Suricata 7.0.12 and 8.0.1 fix the issue. Both releases update the TCP session handling logic to correctly process multiple SYNs with varying sequence numbers within the same flow tuple.
Affected Systems and Versions
- Suricata versions 7.0.11 and below
- Suricata version 8.0.0
Both IDS and IPS configurations are affected. The fix is in 7.0.12 (7.x series) and 8.0.1 (8.x series).
Vendor Security History
The Open Information Security Foundation (OISF) has a strong track record of responding quickly to Suricata vulnerabilities. Earlier issues such as CVE-2021-37592 also involved TCP session handling. OISF routinely releases coordinated patches for multiple supported branches and maintains transparent security advisories, and its public disclosure and patching process shows a mature approach to security.
